RomRaider Logo

RomRaider

Open Source ECU Tools
 FAQ •  Register •  Login 

RomRaider

Documentation

Community

Developers

It is currently Fri Jan 19, 2018 9:09 am

All times are UTC - 5 hours [ DST ]





Post new topic Reply to topic  [ 9 posts ] 
Author Message
 Post subject: Service Workshop Functions for Diesel
PostPosted: Mon Dec 14, 2015 9:25 am 
Offline
Experienced
User avatar

Joined: Wed Nov 10, 2010 7:56 am
Posts: 371
Hey,

as allready in Reset oil dilution threat disscussed, there are some workshop functions for service needed at the EURO4/5 Diesel.

After more and more Diesel getting older and do not need to meet workshop for warranty, people do these service function on theire own. After this, at the Diesels, aou need to reset some counter for e.g. oil dilutation.

But there are more interessing reset or service functions with are very nice to have in RomRaider:

- reading FAP parameter, if you like to replace or chance it
- writing FAP parameter, if you have chanced it
- reading injector codes, if you need to replace them
- wirting injector codes, if you have replaced them

- set ECU in forced regeneration mode
- ...


Got some can sniffs of the SSM-III service routines. After knowing they are OBD- Mode22 based, they are more clear.
For wirting e.g. FAP parameter, the SSM-Tool just overwirte the PID parameter with a new value.

DonĀ“t know, if EURO4 (k-line based SSM-II) will do the same..

We have allready some functions like idle speed setting in RomRaider logger.
If these functions are also "only" over wirting stored parameters, I am quite confident, that for other work shop functions it will be the same.

Any one got more info or experiments ?

BR Jochen

_________________
performence based on engineering..


Top
 Profile  
 
 Post subject: Re: Service Workshop Functions for Diesel
PostPosted: Wed Aug 17, 2016 2:16 am 
Offline
Newbie

Joined: Thu Nov 19, 2015 12:23 am
Posts: 28
I have a 2010 2.0D Outback (Australian) which I desperately need to perform a forced regeneration on.

Last I sent my car to be serviced by Subaru I attached a home brew data logger to the CAN bus, so I have captured an entire session of data, this session included a firmware update and forced regen.

I believe I have found the commands to trigger a forced regen, but I believe the ECU needs to be in maintenance mode first. There were two authentication challenges, one we already know the algo and seed for (used by RR already). The other is new:

Code:
AAAA     = The CAN ID (0x7e0 = Scan tool| 0x7e8 = ECU)
BB       = The message length & ISO-TP bits
CC       = The Mode ID (or'd with 0x40 for response)
DD to II = The data

AAAA|BB|CC|DD|EE|FF|GG|HH|II
----------------------------
07e0|02|10|03|00|00|00|00|00 <- Enter mode 3
07e8|06|67|03|11|57|38|62|00 <- Challenge (0x11573862)
07e0|06|27|04|36|02|63|d0|00 <- Response (0x360263d0)
07e8|02|67|04|00|00|00|00|00 <- Accepted


Just before the tool starting monitoring the DPF soot level, and the EGT DPF Temp, the following commands were issued.

Code:
AAAA|BB|CC|DD|EE|FF|GG|HH|II
----------------------------
07e0|03|22|10|31|00|00|00|00
07e0|03|22|10|30|00|00|00|00
07e8|04|62|10|30|ff|00|00|00
07e0|02|10|03|00|00|00|00|00
07e8|06|67|03|11|57|38|62|00
07e0|06|27|04|36|02|63|d0|00
07e8|02|67|04|00|00|00|00|00
07e0|04|31|03|80|02|00|00|00
07e8|06|71|03|80|02|00|01|00


Top
 Profile  
 
 Post subject: Re: Service Workshop Functions for Diesel
PostPosted: Fri Aug 19, 2016 2:53 pm 
Offline
Newbie

Joined: Thu Nov 19, 2015 12:23 am
Posts: 28
Well, unless we get someone that is VERY good with H8 assembly, this is going to take a while. I managed to find the changes that prevent the Euro5 auth working, it is not the encryption... they made an absolute mess of commands needed to run first to manipulate a variable until it opens up the encryption auth.

Lots of mode 0x10 calls, and mode 0x27 calls.
See my other thread for details


Top
 Profile  
 
 Post subject: Re: Service Workshop Functions for Diesel
PostPosted: Sun Aug 28, 2016 10:53 am 
Offline
Experienced
User avatar

Joined: Wed Nov 10, 2010 7:56 am
Posts: 371
Dale,

after "gnif" successfully entered the security access of his E5 Diesel and shared the seed-and-key algothmen, we can start implementation so of the workshop functions to RomRaider.
It is also needed to implementate Mode 0x22 logging, in best, with DAQ-List oder "steamline" like it is called in "gnif"s theart.

Is there any progress yet ?

May it will be a big help to have the test application, like we have for the k-line on CAN too.
If I can easily set values to the 8 bytes of a CAN-ID by hand, lots of stuff can be done in "develloper-mode" and uses the openPORT interface to get access to the CAN bus.

Best regars
Jochen

_________________
performence based on engineering..


Top
 Profile  
 
 Post subject: Re: Service Workshop Functions for Diesel
PostPosted: Sun Aug 28, 2016 7:27 pm 
Offline
RomRaider Developer

Joined: Wed May 20, 2009 9:49 pm
Posts: 5698
Location: Canada eh!
I haven't had the time to work on it. I had worked out the seed/key calc but went no further due to time constraints. The bigger challenge would be to write code for something I can't test against on the bench as we have no diesel ECUs over here.


Top
 Profile  
 
 Post subject: Re: Service Workshop Functions for Diesel
PostPosted: Mon Aug 29, 2016 3:12 am 
Offline
Experienced
User avatar

Joined: Wed Nov 10, 2010 7:56 am
Posts: 371
If "remote testing" gives enough informations, I think I have a lot test probants ;)
Maybe extend debug functions.

Onbench testing with E4 / E5 and E6 ECU is possible and I think I can activate some Diesel-friends here in europe, with all kinds of generations of Boxer-Diesels :D

I myself still drive a k-line based E4 model

Jochen

_________________
performence based on engineering..


Top
 Profile  
 
 Post subject: Re: Service Workshop Functions for Diesel
PostPosted: Mon Aug 29, 2016 7:55 am 
Offline
RomRaider Developer

Joined: Wed May 20, 2009 9:49 pm
Posts: 5698
Location: Canada eh!
Maybe if someone could send me an ECU to use on the bench I could work on it over the winter then return the ECU.


Top
 Profile  
 
 Post subject: Re: Service Workshop Functions for Diesel
PostPosted: Mon Aug 29, 2016 10:50 am 
Offline
Experienced
User avatar

Joined: Wed Nov 10, 2010 7:56 am
Posts: 371
I allready asked for a E5 ECU to send it to you.
Best will be, if someone got an other spare one, you can keep.

If not, my E5 ECU should have "winter-hollyday in CANADA" :D

_________________
performence based on engineering..


Top
 Profile  
 
 Post subject: Re: Service Workshop Functions for Diesel
PostPosted: Wed Aug 31, 2016 3:23 pm 
Offline
Newbie

Joined: Thu Nov 19, 2015 12:23 am
Posts: 28
Just to confirm, I have re-written my tool to better implement ISO-TP and SSM3 with streamlining, it works completely on my Euro5 ECU for both extended mode 22 and mode A8
Code:
  if (!ecuIssueMode22Requests(
    SSM3_MODE22_COOLANT_TEMP     , SSM3_MODE22_FUELRAIL_PRESSURE, SSM3_MODE22_PRIMARY_BOOST  ,
    SSM3_MODE22_FINAL_INJECTION  , SSM3_MODE22_EGT_CAT          , SSM3_MODE22_EGT_DPF        ,
    SSM3_MODE22_INLET_AIR_TEMP   , SSM3_MODE22_DPF_ASH_RATIO    , SSM3_MODE22_DPF_SOOT_RATIO ,
    SSM3_MODE22_DPF_PRESSURE_DIFF, SSM3_MODE22_OIL_DILUTION     , SSM3_MODE22_OIL_CHANGE_DIST,
    SSM3_MODE22_DPF_REGEN_DIST   , SSM3_MODE22_DPF_REGEN_COUNT  , SSM3_MODE22_DPF_REGEN_SW
  )) return false;


Code:
TX: 22 00 05 00 23 10 AC 11 16 00 3C 00 3E 11 1F 11 49 11 4D 11 4A 11 4E 11 55 11 56 11 57 12 5B
RX: 62 00 05 3E 00 23 00 00 10 AC 40 11 16 00 00 00 3C 02 0F 00 3E 02 0D 11 1F 45 11 49 2B 11 4D 04 11 4A 00 11 4E 04 11 55 55 11 56 00 17 11 57 00 A6 12 5B 00

And SSM2 A8 read example
Code:
  if (!ecuIssueModeA8Requests(
    SSM2_MODEA8_ENGINE_LOAD      , SSM2_MODEA8_ENGINE_RPM_HB    , SSM2_MODEA8_ENGINE_RPM_LB  ,
    SSM2_MODEA8_VEHICLE_SPEED    , SSM2_MODEA8_FUEL_LEVEL       , SSM2_MODEA8_BATTERY_VOLTAGE
  )) return false;

Code:
TX: A8 00 00 00 07 00 00 0E 00 00 0F 00 00 10 00 00 2E 00 02 22
RX: E8 FF 00 00 00 FF 71


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 9 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 1 guest


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
Style based on FI Subsilver by phpBBservice.nl